10/579420 

Docket no.: VOGEL.AIRB.PT1 
Customer no.:24943 

'AP9Rec'dfeWPTO 1 1 MAY 2D0B 1 

METHOD FOR LOAD LIMITATION IN DRIVE SYSTEMS FOR A 

HIGH LIFT SYSTEM FOR AEROPLANES 
Inventors: Udo Carl, Uwe Neumann, and Ben Holert 

5 

The invention relates to a method and an apparatus for 
load limiting in an aircraft high-lift system, with the 
aircraft high-lift system having a branching drive 
10 system for mechanical power transmission to drive 
stations of individual segments of landing flaps and/or 
leading-edge slat systems, position sensors and a drive 
unit . 

15 Aircraft high-lift systems are already known which have 
a central drive unit and a branching drive system for 
mechanical power transmission to the drive stations of 
individual segments of landing-flap/leading-edge slat 
systems. If a landing-flap segment and/or a 

20 transmission for the branching drive system were to 
become blocked, this segment and the corresponding 
branch of the drive system and/or the transmission and 
the corresponding branch of the drive system would have 
to absorb all of the drive energy from the drive unit 

25 as a reaction moment, and would have to be designed to 
be accordingly massive and heavy. 

Mechanical load limiter devices (torque limiters) are 
provided . as protection apparatuses in aircraft 

30 high-lift systems with a branching drive system such as 
these, in order to prevent local overloading in that 
segment and in the corresponding branch of the drive 
system and/or the transmission and the corresponding 
branch of the drive system in the event of blocking of 

35 the landing-flap segment and/or of a transmission in 
the branching drive system. In this case, the 
landing-flap segment is protected by the station load 
limiter (actuation torque limiter) and the branching 
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drive system is protected by the system load limit er 
(system torque limiter) . 

On the basis of mechanical components, load limiter 
5 devices such as these in their own right represent a 
largely optimized solution. However, because of their 
complex design, these systems increase the mass and the 
operating costs of an aircraft equipped with them and, 
furthermore, by nature of their function they are 

10 activated only in the event of faults. Finally, with 
narrow design tolerances and with parametrically 
sensitive system dynamics, these load limiter devices 
can also respond when the drive system is intact and 
operating without faults or errors, then blocking the 

15 entire system. 

The object of the invention is to provide a method of 
the type mentioned initially and an apparatus for 
carrying out a method such as this, which achieve load 
20 limiting with a desirable reduction in the mass and 
operating costs of the system. 

The invention achieves the object by means of a method 
and an apparatus as claimed in the independent claims. 

25 In accordance with the method according to the 
invention, state characteristic variables are detected 
on components of the drive system, and are transmitted 
to a monitoring unit, for load limiting. This 
monitoring unit evaluates the state characteristic 

30 variables by means of an algorithm for fault 
identification, and initiates monitored limiting of the 
drive unit in the event of a fault. This method 
according to the invention means that it is possible to 
limit the fault-dependent overloads resulting from 

35 jamming in a high-lift system, without having to 
provide a mechanical load limiter device. 
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The invention will be explained in more detail in the 
following text with reference to one exemplary 
embodiment, which is illustrated in the drawing, in 
which : 
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Figure 1 shows the schematic design of a flap drive 
system according to the invention, with the 
associated drive components and 

electronically controlled overload 

protection, based on a comparison of signals; 



15 



Figure 2 shows the schematic design of a flap drive 
system according to the invention, in a 
further embodiment; 

Figure 3 shows a flowchart of one method for load 
limiting according to the invention, and 



Figure 4 shows an illustration of an outline of a so- 
20 called generalized observer for fault 

identification on a drive train. 



The drive system as illustrated in Figure 1 for landing 
flaps is equipped with electronically controlled 

25 overload protection rather than with a conventional 
mechanical load limiter. In this case, the drive system 
comprises a port and a starboard subsystem 1, 2, which 
are respectively used to drive two high-lift flaps 3, 4 
and 5, 6 which are arranged on the trailing edges of 

30 the wing, with the two subsystems 1, 2 being designed 
to be symmetrical with respect to one another. The 
mechanical power which is required to position the 
flaps 3 to 6 is produced by a central drive unit 7 
whose power can be controlled in a highly dynamic 

35 manner, and is in each case passed via a drive train 8, 
9, respectively, to a series of mechanical actuators 10 
in the two wings . 
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These in each case include branching transmissions, 
inter alia 11, 12. The individual drive stations 25 are 
connected to the drive train 8 by means of the 
respectively associated branching transmissions 11. 
5 Hydraulically operable brakes 13, 14 are also arranged 
in the outer end area of the drive trains 8, 9. 
Furthermore, asymmetry transmitters 15, 16 are located 
at the two' outer ends of the respective drive trains 8, 
9, that is to say an angle position transmitter by 

10 means of which the instantaneous angle position of the 
shaft at the end of each drive train 8, 9 can be 
determined and, if appropriate, any asymmetric position 
of the flaps can be identified from an asymmetric angle 
position. The arrangement is completed by an angle 

15 position transmitter 17 located at the drive unit 7, 
with the three last-mentioned components each being 
connected via a respectively associated transmitter 
unit 18 to 20 and corresponding signal lines 21, 22 to 
a special monitoring unit 23, which is equipped with a 

20 monitor in order to identify jamming. 

Because of the symmetrical design of the drive system 
and of the flaps, the states of the two subsystems will 
differ only slightly from one another during normal 

25 flight, since the two subsystems for power transmission 
to the flaps on the port and starboard wings have a 
virtually identical dynamic response. One possible 
minor difference is caused essentially by an asymmetric 
air load distribution on the two wings, which can be 

30 taken into account analytically by means of adaptive 
threshold values in the course of the fault 
identification process, when the spoiler deflections 
and airspeed are known. In the event of jamming, in 
contrast, the mechanical characteristics of one of the 

35 two subsystems will change significantly, and thus also 
its dynamic response. If the stimulus by the drive unit 
7 is identical, this leads to different states in these 
two subsystems. In this case, the sound subsystem also 
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acts as a reference system for the faulty subsystem. A 
signal comparison between the states at the respective 
ends of the two drive trains and/or between other 
symmetric states of the port and starboard subsystems 
5 1, 2 therefore leads in the case of jamming to 
differences which would not occur in the sound normal 
case and are used according to the invention for 
detection of jamming. 

In order to preclude material failure, the drive unit 7 
is now limited if predetermined threshold values for 
the state differences are exceeded as a result of 
jamming. In addition, a reduced load on the output 
drives is achieved in the case of jamming by means of 
predetermined flexibility of the elements, the shaft 
section 27, between the drive unit 7 and the first 
branching transmission 26, without having to reduce the 
dominance of jamming on the states of a subsystem. The 
evaluation of the signals which are required for fault 
identification in the event of jamming such as this and 
the initialization of monitored limiting of the central 
drive unit 7 are in this case carried out in the 
monitoring unit 23, which is itself a component of an 
actuation and monitor computer 24 for the high-lift 
flap system. 

Figure 1 thus shows an apparatus for load limiting in 
an aircraft high-lift system, with the aircraft high- 
lift system having a branching drive system for 
30 mechanical power transmission to drive stations 25 of 
individual segments 3, 4, 5, 6 of landing-flap and/or 
leading-edge slat systems, position sensors 8, 9, 17 
and a drive unit 7, with the apparatus for load 
limiting having a monitoring unit 23 which is connected 
35 to the position sensors 8, 9, 17 and is designed to 
process signals from the position sensors 8, 9, 17 and 
to produce a signal in order to limit the drive power 
that is supplied. 
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The position sensors have an angle position transmitter 
17 on the drive unit, and/or angle position 
transmitters 15, 16, which operate as asymmetry 
5 transmitters, at the ends of the drive trains 8, 9. 

The flap drive system which is illustrated in Figure 2 
in the implementation of this method relates to 
electronically controlled overload protection by means 

10 of signal-based diagnosis. The drive system is designed 
to be largely identical to that illustrated in 
Figure 1, and is used to drive two high-lift flaps 103, 
104 and 105, 106, respectively, on the trailing edges 
of a wing via a central drive unit 107 and, via two 

15 drive trains 108, 109, branching transmissions 111, 112 
as well as mechanical actuators 110. In this case as 
well, hydraulically operable brakes 113, 114 and 
asymmetry transmitters 115, 116 are located in the 
outer end area of the drive trains 108, 109. 

20 Furthermore, an angle position transmitter 117 is 
provided on the drive unit 107. In addition to the 
transmitter units 118 to 120 and corresponding signal 
lines, further signal transmitters 125, 126 (which are 
likewise connected to the monitoring unit 123) are, 

25 however, in this case provided on the drive trains 108, 
109, in each case in the immediate vicinity of the 
branching transmissions 111, 112. 

One particularly preferred embodiment of the invention 
30 uses signals from position sensors 17, 15, 16 from 
Figure 1 and two further signals from position sensors 
in the immediate vicinity of the respective first 
branching transmissions of the port and starboard drive 
train, in order to limit the load in the drive train. 
35 This embodiment allows the system load limiter to be 
replaced. 
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Figure 3 uses a flowchart 230 to describe a method 
according to the invention for load limiting in an 
aircraft high-lift system, with the aircraft high-lift 
system having a branching drive system for mechanical 
5 power transmission to drive stations of individual 
segments of landing-flap and/or leading-edge slat 
systems, position sensors and a drive unit. 

Signals from at least two position sensors are measured 
10 in method 'step 231. These signals represent the angular 
positions at the positions of the position sensors in 
the drive train. A plurality of position sensors may 
also be used along the drive train. These signals are 
supplied to the monitoring unit 23 as shown in Figure 1 
15 or 123 as shown in Figure 2, in which the next method 
steps are also carried out. 

At least one reference variable is calculated from the 
measured signals from the position sensors in method 
20 step 232. The reference variable is the indicator for 
identification of jamming, and thus of overloading. The 
determination of the reference variable is described in 
the following text. 

25 Each reference variable is compared with a 
corresponding threshold value, which is defined in 
advance from a maximum permissible load, in the next 
method step 233. Various reference variables may be 
defined, corresponding to identical or different 

30 threshold values. 

Provided that none of the reference variables reaches 
or exceeds the corresponding threshold value, branching 
takes place as shown by the arrow 235 to the method 
35 step 231,. and further measurements of signals from 
position sensors are carried out. 
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If at least one of the reference variables reaches or 
exceeds the corresponding threshold value, branching 
takes place as shown by the arrow 234 to the method 
step 236, to the production of a control signal for 
5 limiting the drive power in the monitoring unit 23 from 
Figure 1 or 123 from Figure 2. 

The drive power of the drive unit is limited using the 
control signal in method step 237. In this case, the 

10 control signal which is produced by the monitoring unit 
is passed to the monitoring computer 24 shown in 
Figure 1, or 124 in Figure 4, which initiates monitored 
limiting of the power supply of the system by the drive 
unit. The drive system advantageously has a highly 

15 dynamic drive unit for rapid control of the drive 
power . 

The measured signals from two position sensors can be 
used together with knowledge of the flexibility 

20 (reciprocal of the stiffness) of the drive train 
between the positions of the position sensors to 
calculate the load in this section. The load 
distribution throughout the entire drive train can be 
calculated corresponding to the number of positions of 

25 the position sensors in the drive train. Various 
reference variables and a corresponding threshold value 
can be defined on the basis of these relationships and 
the maximum load on the overall system in the sound 
state, which is predetermined by the design or can be 

30 determined. 

Because the difference in the load in the drive train 
upstream of and downstream from a branching 
transmission represents a drive train load to be 
35 limited, one of the reference variables in one 
preferred embodiment includes at least one difference 
between measured signals from at least two position 
sensors . 
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In a further preferred embodiment, two signals are 
measured with a known time interval at at least one 
position sensor, in order to determine the angular 
5 velocity from this. The difference in the angular 
velocities between differently positioned position 
sensors is an indicator of abrupt deceleration of the 
angular velocity at one point in the drive train. In 
consequence, an appropriate reference variable, which 

10 is a function of the difference between angular 
velocities, in conjunction with a suitable threshold 
value, identifies hard jamming which would undoubtedly 
lead to overloading. Various reference variables and an 
appropriate threshold value can be defined on the basis 

15 of these relationships and the maximum rotation-speed 
difference in the sound state, which is predetermined 
by the design or can be determined. 

One of the reference variables preferably includes a 
20 function of acceleration. The considerations which are 
required for definition of the reference variable and 
for determination of the associated threshold value are 
obtained in a manner which, to a person skilled in the 
art, is similar to that in the case of the angular 
25 velocity. 

In a further preferred embodiment, one of the reference 
variables uses a calculated load with similar 
considerations as above. 

30 

In a further preferred embodiment, the drive power of 
the drive unit is determined in order to more 
accurately deduce the load distribution in the drive 
train . 

35 

In yet another preferred embodiment, a threshold value 
is predetermined appropriately for an operating state. 
This allows the least-possible load in the event of 
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jamming to be taken into account in every operating 
state of the system. 

In another preferred embodiment, one of the reference 
5 variables includes a function of a state variable, 
which is estimated by means of mathematical methods, 
from a group comprising position, velocity and load. A 
model-based system can thus allow quicker jamming 
identification, with the number of sensors being 
10 reduced at the same time. 

Figure 4 . shows the implementation of one such 
model-based system, in particular illustrating both the 
sensor positions and the structural configuration of an 
15 observer. In addition to the input 

(1) Vrcu? 

the difference between the measured output variable 

(2) y„=[<Ps3 *>S3 9>SS *>S5 M PCuf 

and the output variable of the model is fed back as an 
20 additional input variable to the observer. 

Investigations relating to state estimation using 
different sensor configurations have shown that this 
choice of the sensor arrangement can be regarded as the 

25 minimum with regard to sensors. The sensor system which 
is already implemented in present-day high-lift systems 
at the end of the shaft transmission and at the drive 
unit just has to have one sensor added to it, located 
centrally between these positions, in order to ensure 

30 the required quality of the observer. 

An observer bank for identification of actuator faults 
is distinguished by all of the available inputs and 
outputs of the system in each case being used for 
35 operation of the observer, but with one individual 
defined input or output not being considered. The 
reference variable 



1 1 Docket no.: VOGEL.AIRB.PT1 

Customer no.:24943 

(3) r^^tpn-Pn 

is distinguished primarily by the lack of feedback of 
the position signal qp S i to the observer. Because this 
value is mapped correctly by the observer in the sound 
5 state but not in the event of jamming, jamming results 
in a significant difference between the real position 
and the estimated position. The observer as shown in 
Figure 4 can in consequence not correct the resultant 
state estimation error in the event of jamming. The 
10 threshold value is in this case chosen such that the 
reference variable is less than the threshold value in 
the sound state. 



